#! /bin/bash
# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
# chmod +x cfssl* && mv cfssl* /usr/local/bin/
##################################### 签证 ###########################################
set -e
BASEPATH=$(pwd)
KUBE_APISERVER="https://10.0.0.12:6443"
SSL=${BASEPATH}/ssl
CONF=${BASEPATH}/conf
BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x | tr -d ' ')
cd /root
if [ ! -d "$SSL" ]; then
  mkdir -p $SSL 
fi
if [ ! -d "$CONF" ]; then
  mkdir -p $CONF
fi
cat > ${SSL}/token.csv <<EOF
${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,"system:kubelet-bootstrap"
EOF
cd $SSL
#####################################生成证书请求文件##################################
cat > ca-config.json <<EOF
{
  "signing": {
      "default": {
          "expiry": "876000h"
        },
      "profiles": {
          "peer": {
              "usages": [
                  "signing",
                  "key encipherment",
                  "server auth",
                  "client auth"
              ],
              "expiry": "876000h"
          },
          "server": {
              "usages": [
                  "signing",
                  "key encipherment",
                  "server auth"
              ],
              "expiry": "876000h"
          },
          "client": {
              "usages": [
                  "signing",
                  "key encipherment",
                  "client auth"
              ],
              "expiry": "876000h"
          }
      }
  }
}
EOF
# ca证书创建，例：genca() ca-csr.json
genca()
{
     cfssl gencert -initca $1 | cfssljson -bare $2
}
# server|peer|client证书创建，例：gencert() peer ca.pem  ca-key.pem ca-config.json  apiserver
gencert()
{
    cfssl gencert -ca=$2 -ca-key=$3 -config=ca-config.json -profile=$1  $4-csr.json | cfssljson -bare $4
}
# 1.kubernetets集群组件ca证书请求文件
cat > ca-csr.json <<EOF
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shaanxi",
      "L": "xian",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF
# 2.Aggregation代理ca证书请求文件
cat > front-proxy-ca-csr.json <<EOF
{
  "CN": "front-proxy-ca",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shaanxi",
      "L": "xian",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF
##创建证书
#1.创建k8s集群ca证书
genca ca-csr.json ca
#2.创建Aggregation代理ca证书
genca front-proxy-ca-csr.json front-proxy-ca
# 3.service Account ca证书请求文件(可以使用kubernetes ca证书代替)

#####################################生成证书请求文件##################################
cat > etcd-csr.json <<"EOF" 
{
  "CN": "etcd",
  "hosts": [   
    "127.0.0.1",
    "10.0.0.12",
    "10.0.0.13",
    "10.0.0.14"    
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
     "C": "CN",
     "ST": "shaanxi",
     "L": "xian",
     "O": "system:masters",
     "OU": "system"
    }
  ]
}
EOF
cat > apiserver-csr.json <<EOF
{
    "CN": "kubernetes",
    "hosts": [
      "127.0.0.1",
      "10.0.0.12",
      "10.0.0.13",
      "43.134.96.149",
      "172.16.0.1",
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "shaanxi",
            "L": "xian",
            "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF
cat > apiserver-kubelet-client-csr.json <<EOF
{
    "CN": "apiserver-kubelet",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "shaanxi",
            "L": "xian",
            "O": "system:masters",
            "OU": "System"
        }
    ]
}
EOF
cat > front-proxy-client-csr.json <<EOF
{
    "CN": "front-proxy",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "shaanxi",
            "L": "xian",
            "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF
##创建证书
#1.创建etcd peer证书
gencert peer ca.pem  ca-key.pem  etcd
#2.创建apiserver server证书
gencert server ca.pem  ca-key.pem  apiserver
#3.创建apiserver-kubelet client证书
gencert client ca.pem  ca-key.pem  apiserver-kubelet-client
#3.创建front-proxy client证书
gencert client front-proxy-ca.pem front-proxy-ca-key.pem front-proxy-client

# 生成kubeconfig需要的client证书请求文件
cat > admin-csr.json <<EOF
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shaanxi",
      "L": "xian",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}
EOF
cat > controller-manager-csr.json << EOF
{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [],
    "names": [
      {
        "C": "CN",
        "ST": "shaanxi",
        "L": "xian",
        "O": "system:kube-controller-manager",
        "OU": "system"
      }
    ]
}
EOF
cat > scheduler-csr.json << "EOF"
{
    "CN": "system:kube-scheduler",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
      {
        "C": "CN",
        "ST": "shaanxi",
        "L": "xian",
        "O": "system:kube-scheduler",
        "OU": "system"
      }
    ]
}
EOF
cat > kube-proxy-csr.json <<EOF
{
  "CN": "system:kube-proxy",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "shaanxi",
      "L": "xian",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

##创建证书
for i in admin controller-manager scheduler kube-proxy
do
  gencert client ca.pem  ca-key.pem  $i
done

#
#wget https://dl.k8s.io/v1.8.4/kubernetes-client-linux-amd64.tar.gz && tar -xzvf kubernetes-client-linux-amd64.tar.gz &&　cp kubernetes/client/bin/kube* /usr/bin/　&&　chmod a+x /usr/bin/kube*
##设置kubectl kubeconfig *************************************************************************
# 设置集群参数
kubectl config set-cluster kubernetes \
  --certificate-authority=${SSL}/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=${CONF}/admin.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials admin \
  --client-certificate=${SSL}/admin.pem \
  --embed-certs=true \
  --client-key=${SSL}/admin-key.pem \
  --kubeconfig=${CONF}/admin.kubeconfig
# 设置上下文参数
kubectl config set-context default \
  --cluster=kubernetes \
  --user=admin \
  --kubeconfig=${CONF}/admin.kubeconfig
# 设置默认上下文
kubectl config use-context default --kubeconfig=${CONF}/admin.kubeconfig

##创建 kube-controller-manager kubeconfig 文件 ***************************************************************
kubectl config set-cluster kubernetes \
  --certificate-authority=${SSL}/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=${CONF}/kube-controller-manager.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=${SSL}/controller-manager.pem \
  --client-key=${SSL}/controller-manager-key.pem \
  --embed-certs=true \
  --kubeconfig=${CONF}/kube-controller-manager.kubeconfig
# 设置上下文参数
kubectl config set-context system:kube-controller-manager \
  --cluster=kubernetes \
  --user=system:kube-controller-manager \
  --kubeconfig=${CONF}/kube-controller-manager.kubeconfig
# 设置默认上下文
kubectl config use-context system:kube-controller-manager --kubeconfig=${CONF}/kube-controller-manager.kubeconfig

##创建 kube-kube-scheduler kubeconfig 文件 ****************************************************************
kubectl config set-cluster kubernetes \
  --certificate-authority=${SSL}/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=${CONF}/kube-scheduler.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials system:kube-scheduler \
  --client-certificate=${SSL}/scheduler.pem \
  --client-key=${SSL}/scheduler-key.pem \
  --embed-certs=true \
  --kubeconfig=${CONF}/kube-scheduler.kubeconfig
# 设置上下文参数
kubectl config set-context system:kube-scheduler \
  --cluster=kubernetes \
  --user=system:kube-scheduler \
  --kubeconfig=${CONF}/kube-scheduler.kubeconfig
# 设置默认上下文
kubectl config use-context system:kube-scheduler --kubeconfig=${CONF}/kube-scheduler.kubeconfig

##创建 kubelet bootstrapping kubeconfig 文件 ***************************************************************
# 设置集群参数
kubectl config set-cluster kubernetes \
  --certificate-authority=${SSL}/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=${CONF}/bootstrap.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap \
  --token=${BOOTSTRAP_TOKEN} \
  --kubeconfig=${CONF}/bootstrap.kubeconfig
# 设置上下文参数
kubectl config set-context default \
  --cluster=kubernetes \
  --user=kubelet-bootstrap \
  --kubeconfig=${CONF}/bootstrap.kubeconfig
# 设置默认上下文
kubectl config use-context default --kubeconfig=${CONF}/bootstrap.kubeconfig

##创建 kube-proxy kubeconfig 文件 *******************************************************************
kubectl config set-cluster kubernetes \
  --certificate-authority=${SSL}/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=${CONF}/kube-proxy.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials system:kube-proxy \
  --client-certificate=${SSL}/kube-proxy.pem \
  --client-key=${SSL}/kube-proxy-key.pem \
  --embed-certs=true \
  --kubeconfig=${CONF}/kube-proxy.kubeconfig
# 设置上下文参数
kubectl config set-context system:kube-proxy \
  --cluster=kubernetes \
  --user=system:kube-proxy \
  --kubeconfig=${CONF}/kube-proxy.kubeconfig
# 设置默认上下文
kubectl config use-context system:kube-proxy --kubeconfig=${CONF}/kube-proxy.kubeconfig

